# Workload Identity Metadata

[2 · Identify](/category/identify/)
Candidate · auto-drafted, unreviewed · confidence 80%

| Workload Identity Metadata |
| --- |
| Category | [Identify](/category/identify/) |
| Part of | [Workload Identity in Multi System Environments (WIMSE) Architecture](/protocols/wimse/) |
| Governed by | IETF WIMSE working group mailing list; individual Internet-Draft |
| Status | Internet-Draft, Intended Status: Standards Track; expires 19 April 2027 |
| Phase | draft |
| Implementation | unknown |
| Adoption | unmeasured |
| Version | draft-heigh-wimse-workload-identity-metadata-00 (2026-10-16) |
| Specification | [https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00](https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00) |
| Found at | Optional JWT claim or X.509 certificate extension in the workload credential that identifies the workload metadata endpoint |
| Last checked | 2026-10-19 |
| Freshness | current · checked 2026-10-19 |
| Solves | Prove an agent's identity, Audit what an agent did, Delegate a user's authority to an agent |

Workload Identity Metadata is an agentic-web standard (endpoint) at step 2, Identify, governed by IETF WIMSE working group mailing list; its own status is "Internet-Draft, Intended Status: Standards Track; expires 19 April 2027" (draft). It answers: How can a workload's group, role, and entitlement attributes be conveyed to relying parties without encoding them in the workload identifier? Adoption is unmeasured, last verified 2026-10-19.

[Identify](/category/identify/) This Internet-Draft specifies metadata attributes (group, role, entitlements) for workload identities, profiling existing JWT claims and defining an authenticated workload metadata endpoint usable with JWT- or X.509-based credentials. It defines a separation principle between identifier and metadata, including identifier uniqueness requirements. An optional JWT claim or X.509 extension points to the metadata endpoint. It applies to workloads generally, including AI agents, with agentic use cases discussed separately.

## Discovery and probe

Optional JWT claim or X.509 certificate extension in the workload credential that identifies the workload metadata endpoint

```
NONE
parse:
on absent: Support cannot be observed externally; the endpoint location is carried inside workload credentials, so treat as unobserved.
```

Not probed live: no-fixed-path. candidate record; probe rule pending

## History
- 2026-10-19 — auto-drafted candidate from exa (https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00)

## Instances

No instances recorded yet.

## See also

- Part of: [Workload Identity in Multi System Environments (WIMSE) Architecture](/protocols/wimse/)

## References

- Internet-Draft draft-heigh-wimse-workload-identity-metadata-00 published 16 October 2026 by S. Heigh, J. Salowey (Palo Alto Networks) and Y. Rosomakho (Zscaler); specifies workload metadata attributes delivered in JWT-based credentials or via an authenticated metadata endpoint, separate from the workload identifier. — [https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00](https://datatracker.ietf.org/doc/html/draft-heigh-wimse-workload-identity-metadata-00) (2026-10-16) REPORTED

[JSON](/data/protocols/wimse-workload-identity-metadata.json) · [Markdown](/protocols/wimse-workload-identity-metadata/index.md)